CVE-2022-28346
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods ar...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.28"},{"introduced":"3.2.0"},{"fixed":"3.2.13"},{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-28346 python-django Corrigé dans: 2:2.2.28-1~deb11u1
Références
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory lists.debian.org
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov